@intentius/chant 0.124.5 → 0.124.7

package/src/op/gate-resume.ts

@@ -36,102 +36,10 @@ import { ForgeApiError, type ForgeFetch, type ForgeKind } from "../pr-forge";
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
 import { latestResolutionForPlan } from "../lifecycle/gate-ledger";
 import { humanQuorumSince, tallyGateApprovals } from "./gate";
+import type { GateRunLocator } from "./gate-run-locator";
 
-/** Where the job that recorded a pending fact runs, and what its forge needs to start it again. */
-export interface GateRunLocator {
-  forge: ForgeKind;
-  /** The forge's API base: `$GITHUB_API_URL` (GitHub and Forgejo) or `$CI_API_V4_URL` (GitLab). */
-  api: string;
-  /** `owner/name` on GitHub and Forgejo, the project id on GitLab. */
-  repo: string;
-  /** The run: GitHub's and Forgejo's run id, GitLab's pipeline id. */
-  run: string;
-  /** GitHub: the run attempt that waited. A later attempt means it was already re-run. */
-  attempt?: number;
-  /** GitLab: the job that waited. */
-  job?: string;
-  /** GitLab: that job's name, to find a retry of it. */
-  jobName?: string;
-  /** Forgejo: the workflow file the run came from, which a dispatch names. */
-  workflow?: string;
-  /** Forgejo: the branch a dispatch runs on. */
-  ref?: string;
-  /** The run's page, for a person. */
-  url?: string;
-}
-
-const trimSlash = (s: string): string => s.replace(/\/+$/, "");
-
-/**
- * The locator of the CI job this process runs in, or undefined outside CI or
- * when the environment lacks a part a resume needs. Forgejo Actions sets the
- * `GITHUB_*` variables too, and is told apart by `FORGEJO_ACTIONS` or
- * `GITEA_ACTIONS`.
- */
-export function resolveGateRunLocator(env: Record<string, string | undefined> = process.env): GateRunLocator | undefined {
-  if (env.GITLAB_CI === "true") {
-    if (!env.CI_API_V4_URL || !env.CI_PROJECT_ID || !env.CI_PIPELINE_ID || !env.CI_JOB_ID) return undefined;
-    return {
-      forge: "gitlab",
-      api: trimSlash(env.CI_API_V4_URL),
-      repo: env.CI_PROJECT_ID,
-      run: env.CI_PIPELINE_ID,
-      job: env.CI_JOB_ID,
-      ...(env.CI_JOB_NAME ? { jobName: env.CI_JOB_NAME } : {}),
-      ...(env.CI_JOB_URL ? { url: env.CI_JOB_URL } : {}),
-    };
-  }
-  if (env.GITHUB_ACTIONS !== "true" || !env.GITHUB_REPOSITORY || !env.GITHUB_RUN_ID) return undefined;
-  const forgejo = env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true";
-  const server = env.GITHUB_SERVER_URL ? trimSlash(env.GITHUB_SERVER_URL) : undefined;
-  const url = server ? `${server}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : undefined;
-  if (forgejo) {
-    const workflow = forgejoWorkflowFile(env);
-    const api = env.GITHUB_API_URL ?? (server ? `${server}/api/v1` : undefined);
-    if (!api || !workflow || !env.GITHUB_REF_NAME) return undefined;
-    return {
-      forge: "forgejo",
-      api: trimSlash(api),
-      repo: env.GITHUB_REPOSITORY,
-      run: env.GITHUB_RUN_ID,
-      workflow,
-      ref: env.GITHUB_REF_NAME,
-      ...(url ? { url } : {}),
-    };
-  }
-  const attempt = Number(env.GITHUB_RUN_ATTEMPT);
-  return {
-    forge: "github",
-    api: trimSlash(env.GITHUB_API_URL ?? "https://api.github.com"),
-    repo: env.GITHUB_REPOSITORY,
-    run: env.GITHUB_RUN_ID,
-    ...(Number.isInteger(attempt) && attempt > 0 ? { attempt } : {}),
-    ...(url ? { url } : {}),
-  };
-}
-
-/**
- * The workflow file a Forgejo run came from, by its base name. Forgejo names
- * a workflow by its file (`GITHUB_WORKFLOW`, `deploy.yml`); `GITHUB_WORKFLOW_REF`
- * (`owner/repo/.forgejo/workflows/deploy.yml@refs/heads/main`) says it too.
- */
-function forgejoWorkflowFile(env: Record<string, string | undefined>): string | undefined {
-  const fromRef = env.GITHUB_WORKFLOW_REF?.split("@")[0]?.split("/").pop();
-  if (fromRef && /\.ya?ml$/.test(fromRef)) return fromRef;
-  const name = env.GITHUB_WORKFLOW;
-  return name && /\.ya?ml$/.test(name) ? name.split("/").pop() : undefined;
-}
-
-/** Whether `value` is a {@link GateRunLocator} a resume can use. */
-export function isGateRunLocator(value: unknown): value is GateRunLocator {
-  if (!value || typeof value !== "object") return false;
-  const v = value as Record<string, unknown>;
-  if (typeof v.api !== "string" || typeof v.repo !== "string" || typeof v.run !== "string") return false;
-  if (v.forge === "github") return true;
-  if (v.forge === "gitlab") return typeof v.job === "string";
-  if (v.forge === "forgejo") return typeof v.workflow === "string" && typeof v.ref === "string";
-  return false;
-}
+// The locator is read where a pending fact is recorded, which `@intentius/chant/point-decision` does too, so it lives on its own (#3835).
+export { isGateRunLocator, resolveGateRunLocator, type GateRunLocator } from "./gate-run-locator";
 
 /** What {@link resumeGateRun} did. */
 export type GateResumeOutcome =
@@ -145,6 +53,8 @@ export interface ResumeGateRunOptions {
   fetch?: ForgeFetch;
 }
 
+const trimSlash = (s: string): string => s.replace(/\/+$/, "");
+
 const isObject = (v: unknown): v is Record<string, unknown> => typeof v === "object" && v !== null && !Array.isArray(v);
 
 function client(base: string, headers: Record<string, string>, fetchImpl: ForgeFetch) {

package/src/op/gate-run-locator.ts

@@ -0,0 +1,105 @@
+/**
+ * Where a CI job that waits at a gate runs, and what its forge needs to start
+ * it again (#3683). Read from the job's environment when a pending fact is
+ * recorded; `./gate-resume.ts` uses it to resume the job. It imports nothing
+ * at run time, so `@intentius/chant/point-decision` records it on the pending
+ * fact of a gate that asks a decision point too (#3835).
+ */
+
+import type { ForgeKind } from "../pr-forge";
+
+/** Where the job that recorded a pending fact runs, and what its forge needs to start it again. */
+export interface GateRunLocator {
+  forge: ForgeKind;
+  /** The forge's API base: `$GITHUB_API_URL` (GitHub and Forgejo) or `$CI_API_V4_URL` (GitLab). */
+  api: string;
+  /** `owner/name` on GitHub and Forgejo, the project id on GitLab. */
+  repo: string;
+  /** The run: GitHub's and Forgejo's run id, GitLab's pipeline id. */
+  run: string;
+  /** GitHub: the run attempt that waited. A later attempt means it was already re-run. */
+  attempt?: number;
+  /** GitLab: the job that waited. */
+  job?: string;
+  /** GitLab: that job's name, to find a retry of it. */
+  jobName?: string;
+  /** Forgejo: the workflow file the run came from, which a dispatch names. */
+  workflow?: string;
+  /** Forgejo: the branch a dispatch runs on. */
+  ref?: string;
+  /** The run's page, for a person. */
+  url?: string;
+}
+
+const trimSlash = (s: string): string => s.replace(/\/+$/, "");
+
+/**
+ * The locator of the CI job this process runs in, or undefined outside CI or
+ * when the environment lacks a part a resume needs. Forgejo Actions sets the
+ * `GITHUB_*` variables too, and is told apart by `FORGEJO_ACTIONS` or
+ * `GITEA_ACTIONS`.
+ */
+export function resolveGateRunLocator(env: Record<string, string | undefined> = process.env): GateRunLocator | undefined {
+  if (env.GITLAB_CI === "true") {
+    if (!env.CI_API_V4_URL || !env.CI_PROJECT_ID || !env.CI_PIPELINE_ID || !env.CI_JOB_ID) return undefined;
+    return {
+      forge: "gitlab",
+      api: trimSlash(env.CI_API_V4_URL),
+      repo: env.CI_PROJECT_ID,
+      run: env.CI_PIPELINE_ID,
+      job: env.CI_JOB_ID,
+      ...(env.CI_JOB_NAME ? { jobName: env.CI_JOB_NAME } : {}),
+      ...(env.CI_JOB_URL ? { url: env.CI_JOB_URL } : {}),
+    };
+  }
+  if (env.GITHUB_ACTIONS !== "true" || !env.GITHUB_REPOSITORY || !env.GITHUB_RUN_ID) return undefined;
+  const forgejo = env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true";
+  const server = env.GITHUB_SERVER_URL ? trimSlash(env.GITHUB_SERVER_URL) : undefined;
+  const url = server ? `${server}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : undefined;
+  if (forgejo) {
+    const workflow = forgejoWorkflowFile(env);
+    const api = env.GITHUB_API_URL ?? (server ? `${server}/api/v1` : undefined);
+    if (!api || !workflow || !env.GITHUB_REF_NAME) return undefined;
+    return {
+      forge: "forgejo",
+      api: trimSlash(api),
+      repo: env.GITHUB_REPOSITORY,
+      run: env.GITHUB_RUN_ID,
+      workflow,
+      ref: env.GITHUB_REF_NAME,
+      ...(url ? { url } : {}),
+    };
+  }
+  const attempt = Number(env.GITHUB_RUN_ATTEMPT);
+  return {
+    forge: "github",
+    api: trimSlash(env.GITHUB_API_URL ?? "https://api.github.com"),
+    repo: env.GITHUB_REPOSITORY,
+    run: env.GITHUB_RUN_ID,
+    ...(Number.isInteger(attempt) && attempt > 0 ? { attempt } : {}),
+    ...(url ? { url } : {}),
+  };
+}
+
+/**
+ * The workflow file a Forgejo run came from, by its base name. Forgejo names
+ * a workflow by its file (`GITHUB_WORKFLOW`, `deploy.yml`); `GITHUB_WORKFLOW_REF`
+ * (`owner/repo/.forgejo/workflows/deploy.yml@refs/heads/main`) says it too.
+ */
+function forgejoWorkflowFile(env: Record<string, string | undefined>): string | undefined {
+  const fromRef = env.GITHUB_WORKFLOW_REF?.split("@")[0]?.split("/").pop();
+  if (fromRef && /\.ya?ml$/.test(fromRef)) return fromRef;
+  const name = env.GITHUB_WORKFLOW;
+  return name && /\.ya?ml$/.test(name) ? name.split("/").pop() : undefined;
+}
+
+/** Whether `value` is a {@link GateRunLocator} a resume can use. */
+export function isGateRunLocator(value: unknown): value is GateRunLocator {
+  if (!value || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  if (typeof v.api !== "string" || typeof v.repo !== "string" || typeof v.run !== "string") return false;
+  if (v.forge === "github") return true;
+  if (v.forge === "gitlab") return typeof v.job === "string";
+  if (v.forge === "forgejo") return typeof v.workflow === "string" && typeof v.ref === "string";
+  return false;
+}

package/src/point-decision-bundle.test.ts

@@ -54,6 +54,7 @@ describe("the point-decision bundle", () => {
       "packages/core/src/lifecycle/plan-digest.ts",
       "packages/core/src/op/duration.ts",
       "packages/core/src/op/gate-point.ts",
+      "packages/core/src/op/gate-run-locator.ts",
       "packages/core/src/point-decision.ts",
     ]);
     const bytes = result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0);

package/src/point-decision.ts

@@ -20,6 +20,11 @@
  * TypeScript, zod or git code, which `point-decision-bundle.test.ts` holds
  * it to. `./op/gate-point-run.ts` re-exports it, and chant's own runs decide
  * by it.
+ *
+ * A gate's resolution is written only when its run asks again, so a resume
+ * job asks {@link pointGateResumable} whether a waiting job's question now
+ * has an answer that passes the gate (#3835), with the questions
+ * {@link chantPointQuestions} reads. `chant run resume` makes the same check.
  */
 
 import { execFile } from "node:child_process";
@@ -31,6 +36,7 @@ import { parseDuration } from "./op/duration";
 import type { GateLedgerPort } from "./op/gate";
 import { DEFAULT_GATE_POINT_PASS, defaultGatePointStore, gatePointInputs, gateSubject, type GatePoint, type GatePointFacts, type GatePointStore } from "./op/gate-point";
 import type { WaitingPoint } from "./op/steward-points";
+import { resolveGateRunLocator, type GateRunLocator } from "./op/gate-run-locator";
 
 export {
   DEFAULT_GATE_POINT_PASS,
@@ -40,12 +46,14 @@ export {
   gatePointOf,
   gatePointProblems,
   gateSubject,
+  parseGateSubject,
   type GatePoint,
   type GatePointFacts,
   type GatePointStore,
 } from "./op/gate-point";
 export type { GateAnswerRef, GateResolutionRecord, GateResolutionInput, PendingGateInput, PendingGateRecord } from "./lifecycle/gate-ledger";
 export type { WaitingPoint } from "./op/steward-points";
+export { isGateRunLocator, resolveGateRunLocator, type GateRunLocator } from "./op/gate-run-locator";
 
 /**
  * The gate ledger as {@link evaluatePointGate} uses it: read an op's facts,
@@ -107,6 +115,12 @@ export interface PointGateInput {
   /** The environment the run was started for: the `gate.env` input. Op gate facts on the ledger record none. */
   env?: string;
   now?: string;
+  /**
+   * Where this job runs, for `chant run resume` to start it again once the
+   * question is answered (#3835). Default: read from the CI environment
+   * ({@link resolveGateRunLocator}); false records none.
+   */
+  resume?: GateRunLocator | false;
 }
 
 /** What reaching a gate that asks a point decided. */
@@ -188,6 +202,7 @@ export async function evaluatePointGate(port: PointGateLedgerPort, asker: GatePo
     return { satisfied: false, waiting, pending: standing, recorded: false };
   }
   const url = resolveApprovalUrl();
+  const resume = input.resume === false ? undefined : (input.resume ?? resolveGateRunLocator());
   const { record, pushed, pushWarning } = await port.appendPending({
     op: input.op,
     gate: input.gate,
@@ -197,11 +212,77 @@ export async function evaluatePointGate(port: PointGateLedgerPort, asker: GatePo
     ...(input.runId ? { runId: input.runId } : {}),
     ...(url ? { url } : {}),
     ...(input.planDigest !== undefined ? { planDigest: input.planDigest } : {}),
-    answer: ref,
+    ...(resume ? { resume } : {}),
+    answer: { ...ref, ...(input.point.pass ? { pass: input.point.pass } : {}) },
   });
   return { satisfied: false, waiting, pending: record, recorded: true, pushed, ...(pushWarning ? { pushWarning } : {}) };
 }
 
+/**
+ * A question's state as a resume reads it: what `chant workspace points
+ * --json` lists for it. {@link chantPointQuestions} reads them through the
+ * chant bin; chant's own resume reads the workspace.
+ */
+export interface PointQuestionState {
+  id: string;
+  state: "escalated" | "proposed" | "answered";
+  /** The answer, or null while the question is open. */
+  answer: string | boolean | null;
+  answeredBy: string[];
+  /** When it was answered, as the record says, or null. */
+  answeredOn: string | null;
+}
+
+/** Whether a waiting point-asking gate can be resumed, and why not. */
+export type PointResumeCheck =
+  | {
+      resumable: true;
+      /** The answer that passes the gate, as the resumed run will cite it. */
+      answer: GateAnswerRef;
+      /** Who answered: the people, joined, or `quorum` when the record names none. */
+      answeredBy: string;
+      /** When it was answered, or null. A resume reads a run started after it as already resumed. */
+      answeredOn: string | null;
+    }
+  | {
+      resumable: false;
+      /** `open`: nobody has answered; `refused`: the answer does not pass the gate; `unknown`: no question with the id was read; `not-a-point`: the pending fact cites no question. */
+      why: "open" | "refused" | "unknown" | "not-a-point";
+      message: string;
+    };
+
+/**
+ * Whether the job behind `standing`, a pending fact a gate that asks a
+ * decision point recorded, can be started again (#3835): its question is
+ * answered with an answer the gate passes on (the pending fact's
+ * `answer.pass`, default a noul point's yes). A gate only writes its
+ * resolution when its run asks the point again, so nothing on the gate
+ * ledger says an answered question passes; this is the check
+ * `chant run resume` makes, and a product's own resume job makes the same
+ * call with the questions it read (`chantPointQuestions`). It approves
+ * nothing: the resumed run asks again and decides.
+ */
+export function pointGateResumable(standing: Pick<PendingGateRecord, "answer">, question: PointQuestionState | undefined): PointResumeCheck {
+  const ref = standing.answer;
+  if (!ref) return { resumable: false, why: "not-a-point", message: "the pending fact cites no decision point's question" };
+  if (!question || question.id !== ref.id) return { resumable: false, why: "unknown", message: `question ${ref.id} (${ref.point}) can't be read here` };
+  if (question.state !== "answered" || question.answer === null) return { resumable: false, why: "open", message: `question ${ref.id} (${ref.point}) is ${question.state}, not answered yet` };
+  const pass = ref.pass ?? DEFAULT_GATE_POINT_PASS;
+  if (!pass.includes(question.answer)) {
+    return {
+      resumable: false,
+      why: "refused",
+      message: `question ${ref.id} (${ref.point}) was answered ${JSON.stringify(question.answer)}, and the gate passes only on ${pass.map((a) => JSON.stringify(a)).join(" or ")}`,
+    };
+  }
+  return {
+    resumable: true,
+    answer: { point: ref.point, id: ref.id, path: ref.path, answer: question.answer, ...(question.answeredBy.length > 0 ? { answeredBy: question.answeredBy } : {}) },
+    answeredBy: question.answeredBy.length > 0 ? question.answeredBy.join(", ") : "quorum",
+    answeredOn: question.answeredOn,
+  };
+}
+
 /** How {@link chantGatePointAsker} runs chant. */
 export interface ChantGatePointAskerOptions {
   /** The chant command and its leading arguments, such as `["npx", "chant"]` or `[process.execPath, "/path/to/chant"]`. */
@@ -278,3 +359,18 @@ export function chantGatePointAsker(opts: ChantGatePointAskerOptions): GatePoint
     },
   };
 }
+
+/**
+ * Every question the workspace lists, by id, read through the chant bin with
+ * `chant workspace points --json` (the questions held on `chant/lifecycle`
+ * included), for {@link pointGateResumable} in a tool that bundles this
+ * module (#3835). Fetch `chant/lifecycle` first, as reading the gate ledger
+ * does, so an answer given from another clone is seen.
+ */
+export async function chantPointQuestions(opts: ChantGatePointAskerOptions): Promise<Map<string, PointQuestionState>> {
+  const listed = await runChantJson(opts, ["workspace", "points", "--json"]);
+  const bad = refusal("chant workspace points", listed);
+  if (bad) throw bad;
+  const questions = (listed.questions as PointQuestionState[] | undefined) ?? [];
+  return new Map(questions.map((q) => [q.id, { id: q.id, state: q.state, answer: q.answer ?? null, answeredBy: q.answeredBy ?? [], answeredOn: q.answeredOn ?? null }]));
+}

package/src/pr-forge-bundle.test.ts

@@ -34,7 +34,7 @@ describe("the pr-forge bundle", () => {
       expect(inputs.filter((i) => pattern.test(i)), String(pattern)).toEqual([]);
     }
     expect(inputs.map((i) => i.replace(/^.*?packages\//, "packages/")).sort()).toEqual(["packages/core/src/pr-forge.ts"]);
-    // About 20 KB today.
+    // About 27 KB today.
     expect(result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0)).toBeLessThan(32 * 1024);
   });
 });

package/src/pr-forge.test.ts

@@ -14,9 +14,12 @@ import {
   forgeTargetFromEnv,
   forgejoForge,
   forgePrincipalOf,
+  FORGE_STATUS_STATES,
   githubForge,
   gitlabForge,
+  statusStateFor,
   type ForgeFetch,
+  type ForgeStatusState,
 } from "./pr-forge";
 import { forgePrincipal, parseForgeIdentity } from "./workspace/identity";
 
@@ -675,3 +678,154 @@ describe("addComment and findIssue (#3818)", () => {
     expect(fj.calls[0].headers.Authorization).toBeUndefined();
   });
 });
+
+describe("status states and author lists (#3834)", () => {
+  const gh = { apiBase: "https://api.github.com", repo: "acme/infra", token: "t0k" };
+
+  test("each state goes to each forge as its nearest state", () => {
+    const table = Object.fromEntries(FORGE_STATUS_STATES.map((s) => [s, [statusStateFor("github", s), statusStateFor("forgejo", s), statusStateFor("gitlab", s)]]));
+    expect(table).toEqual({
+      pending: ["pending", "pending", "pending"],
+      running: ["pending", "pending", "running"],
+      success: ["success", "success", "success"],
+      failed: ["failure", "failure", "failed"],
+      failure: ["failure", "failure", "failed"],
+      canceled: ["error", "error", "canceled"],
+      error: ["error", "error", "failed"],
+    });
+    expect(() => statusStateFor("gitlab", "skipped" as ForgeStatusState)).toThrow(/one of pending, running/);
+  });
+
+  test("a running status is running on GitLab and pending on GitHub and Forgejo", async () => {
+    const gl = fakeFetch({ [`POST /api/v4/projects/42/statuses/${SHA}`]: {} });
+    await gitlabForge({ apiBase: "https://gl/api/v4", project: "42", token: "t", fetch: gl.fetch }).setStatus(SHA, { context: "terragucci/plan", state: "running", description: "planning" });
+    await gitlabForge({ apiBase: "https://gl/api/v4", project: "42", token: "t", fetch: gl.fetch }).setStatus(SHA, { context: "terragucci/plan", state: "canceled", description: "stopped" });
+    expect(gl.calls.map((c) => (c.body as { state: string }).state)).toEqual(["running", "canceled"]);
+    const g = fakeFetch({ [`POST /repos/acme/infra/statuses/${SHA}`]: {} });
+    await githubForge({ ...gh, fetch: g.fetch }).setStatus(SHA, { context: "terragucci/plan", state: "running", description: "planning" });
+    await githubForge({ ...gh, fetch: g.fetch }).setStatus(SHA, { context: "terragucci/plan", state: "failed", description: "no" });
+    expect(g.calls.map((c) => (c.body as { state: string }).state)).toEqual(["pending", "failure"]);
+    const fj = fakeFetch({ [`POST /api/v1/repos/acme/infra/statuses/${SHA}`]: {} });
+    await forgejoForge({ ...gh, apiBase: "https://codeberg.org/api/v1", host: "codeberg.org", fetch: fj.fetch }).setStatus(SHA, { context: "c", state: "running", description: "d" });
+    expect(fj.calls[0].body).toMatchObject({ state: "pending" });
+  });
+
+  const BOTS = ["github-actions[bot]", "gitea-actions", "forgejo-actions"];
+
+  test("a comment by any of several logins is the caller's own, without case", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /api/v1/repos/acme/infra/issues/4/comments": [
+        { id: 1, body: "<!-- tg -->\nplanted", user: { login: "mallory" } },
+        { id: 2, body: "<!-- tg -->\nold", user: { login: "Forgejo-Actions" } },
+      ],
+      "PATCH /api/v1/repos/acme/infra/issues/comments/2": { id: 2, html_url: "https://cb/2" },
+    });
+    const forge = forgejoForge({ ...gh, apiBase: "https://codeberg.org/api/v1", host: "codeberg.org", fetch });
+    expect(await forge.findComment(4, "<!-- tg -->", { author: BOTS })).toEqual({ id: 2, body: "<!-- tg -->\nold" });
+    expect(await forge.upsertComment(4, "<!-- tg -->", "<!-- tg -->\nnew", { author: BOTS })).toEqual({ action: "updated", id: 2, url: "https://cb/2" });
+    expect(calls.at(-1)?.url).toBe("https://codeberg.org/api/v1/repos/acme/infra/issues/comments/2");
+    expect(await forge.findComment(4, "<!-- tg -->", { author: [] })).toBeUndefined();
+    expect((await forge.findComment(4, "<!-- tg -->", { author: "mallory" }))?.id).toBe(1);
+  });
+
+  test("an issue by any of several logins, for findIssue and trackIssue", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /repos/acme/infra/issues": [
+        { number: 3, title: "Drift", body: "<!-- d -->\nplanted", user: { login: "mallory" } },
+        { number: 4, title: "Drift", body: "<!-- d -->\nold", user: { login: "github-actions[bot]" } },
+      ],
+      "PATCH /repos/acme/infra/issues/4": { number: 4 },
+    });
+    const forge = githubForge({ ...gh, fetch });
+    expect((await forge.findIssue("<!-- d -->", { author: BOTS }))?.number).toBe(4);
+    expect(await forge.trackIssue("<!-- d -->", { title: "Drift", body: "<!-- d -->\nnew" }, { author: BOTS })).toMatchObject({ action: "updated", number: 4 });
+    expect(calls.at(-1)).toMatchObject({ method: "PATCH", url: "https://api.github.com/repos/acme/infra/issues/4" });
+  });
+});
+
+describe("pull requests over REST (#3798)", () => {
+  const gh = { apiBase: "https://api.github.com", repo: "acme/infra", token: "t0k" };
+  const fjOpts = { ...gh, apiBase: "https://forge.example/api/v1", host: "forge.example" };
+  const gl = { apiBase: "https://gl/api/v4", project: "group/infra", token: "t" };
+
+  test("Forgejo opens a pull request into the default branch read from the repository", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /api/v1/repos/acme/infra": { default_branch: "trunk" },
+      "POST /api/v1/repos/acme/infra/pulls": (c: Call) => ({ number: 9, html_url: "https://forge.example/acme/infra/pulls/9", title: (c.body as { title: string }).title, body: "b", head: { ref: "chant/x" }, base: { ref: "trunk" } }),
+    });
+    const pr = await forgejoForge({ ...fjOpts, fetch }).openPullRequest({ head: "chant/x", title: "t", body: "b" });
+    expect(pr).toEqual({ number: 9, url: "https://forge.example/acme/infra/pulls/9", title: "t", body: "b", head: "chant/x", base: "trunk" });
+    expect(calls.map((c) => `${c.method} ${c.url}`)).toEqual(["GET https://forge.example/api/v1/repos/acme/infra", "POST https://forge.example/api/v1/repos/acme/infra/pulls"]);
+    expect(calls[1].body).toEqual({ title: "t", body: "b", head: "chant/x", base: "trunk" });
+    expect(calls[1].headers.Authorization).toBe("token t0k");
+  });
+
+  test("a draft is GitHub's draft field, Forgejo's WIP: and GitLab's Draft: prefix", async () => {
+    const g = fakeFetch({ "POST /repos/acme/infra/pulls": { number: 1 } });
+    await githubForge({ ...gh, fetch: g.fetch }).openPullRequest({ head: "h", base: "main", title: "t", body: "b", draft: true });
+    expect(g.calls[0].body).toEqual({ title: "t", body: "b", head: "h", base: "main", draft: true });
+    const f = fakeFetch({ "POST /api/v1/repos/acme/infra/pulls": { number: 1 } });
+    await forgejoForge({ ...fjOpts, fetch: f.fetch }).openPullRequest({ head: "h", base: "main", title: "t", body: "b", draft: true });
+    expect(f.calls[0].body).toEqual({ title: "WIP: t", body: "b", head: "h", base: "main" });
+    const l = fakeFetch({ "POST /api/v4/projects/group%2Finfra/merge_requests": { iid: 4, web_url: "https://gl/mr/4", source_branch: "h", target_branch: "main", title: "Draft: t", description: "b" } });
+    const mr = await gitlabForge({ ...gl, fetch: l.fetch }).openPullRequest({ head: "h", base: "main", title: "t", body: "b", draft: true });
+    expect(l.calls[0].body).toEqual({ source_branch: "h", target_branch: "main", title: "Draft: t", description: "b" });
+    expect(mr).toEqual({ number: 4, url: "https://gl/mr/4", title: "Draft: t", body: "b", head: "h", base: "main" });
+  });
+
+  test("GitLab reads the default branch off the project", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /api/v4/projects/group%2Finfra": { default_branch: "main" },
+      "POST /api/v4/projects/group%2Finfra/merge_requests": { iid: 2 },
+    });
+    await gitlabForge({ ...gl, fetch }).openPullRequest({ head: "h", title: "t", body: "b" });
+    expect((calls[1].body as { target_branch: string }).target_branch).toBe("main");
+  });
+
+  test("findPullRequest takes the oldest open one from this repository, not a fork's", async () => {
+    const f = fakeFetch({
+      "GET /api/v1/repos/acme/infra/pulls": [
+        { number: 12, title: "fork", body: "", head: { ref: "chant/x", repo: { full_name: "mallory/infra" } } },
+        { number: 11, title: "newer", body: "", head: { ref: "chant/x", repo: { full_name: "acme/infra" } } },
+        { number: 10, title: "mine", body: "b", head: { ref: "chant/x", repo: { full_name: "acme/infra" } }, base: { ref: "main" }, html_url: "https://forge.example/acme/infra/pulls/10" },
+        { number: 3, title: "other", body: "", head: { ref: "other", repo: { full_name: "acme/infra" } } },
+      ],
+    });
+    const forge = forgejoForge({ ...fjOpts, fetch: f.fetch });
+    expect(await forge.findPullRequest("chant/x")).toEqual({ number: 10, title: "mine", body: "b", head: "chant/x", base: "main", url: "https://forge.example/acme/infra/pulls/10" });
+    expect(f.calls[0].url).toBe("https://forge.example/api/v1/repos/acme/infra/pulls?state=open&limit=50&page=1");
+    expect(await forge.findPullRequest("none")).toBeUndefined();
+
+    const g = fakeFetch({ "GET /repos/acme/infra/pulls": [] });
+    expect(await githubForge({ ...gh, fetch: g.fetch }).findPullRequest("chant/x")).toBeUndefined();
+    expect(g.calls[0].url).toBe("https://api.github.com/repos/acme/infra/pulls?state=open&head=acme%3Achant%2Fx&per_page=100&page=1");
+
+    const l = fakeFetch({
+      "GET /api/v4/projects/group%2Finfra/merge_requests": [
+        { iid: 8, source_branch: "chant/x", project_id: 1, source_project_id: 2, title: "fork", description: "" },
+        { iid: 7, source_branch: "chant/x", project_id: 1, source_project_id: 1, title: "mine", description: "d", target_branch: "main" },
+      ],
+    });
+    expect(await gitlabForge({ ...gl, fetch: l.fetch }).findPullRequest("chant/x")).toEqual({ number: 7, title: "mine", body: "d", head: "chant/x", base: "main" });
+    expect(l.calls[0].url).toBe("https://gl/api/v4/projects/group%2Finfra/merge_requests?state=opened&source_branch=chant%2Fx&per_page=100&page=1");
+  });
+
+  test("editPullRequest and addLabels on each forge", async () => {
+    const f = fakeFetch({ "PATCH /api/v1/repos/acme/infra/pulls/10": { number: 10, title: "t2" }, "POST /api/v1/repos/acme/infra/issues/10/labels": [] });
+    const forge = forgejoForge({ ...fjOpts, fetch: f.fetch });
+    expect((await forge.editPullRequest(10, { title: "t2", body: "b2" }))?.title).toBe("t2");
+    await forge.addLabels(10, ["minor"]);
+    await forge.addLabels(10, []);
+    expect(f.calls.map((c) => [c.method, c.body])).toEqual([["PATCH", { title: "t2", body: "b2" }], ["POST", { labels: ["minor"] }]]);
+    const l = fakeFetch({ "PUT /api/v4/projects/group%2Finfra/merge_requests/7": { iid: 7 } });
+    const g = gitlabForge({ ...gl, fetch: l.fetch });
+    await g.editPullRequest(7, { body: "d" });
+    await g.addLabels(7, ["minor", "breaking"]);
+    expect(l.calls.map((c) => c.body)).toEqual([{ description: "d" }, { add_labels: "minor,breaking" }]);
+  });
+
+  test("a repository with no default branch is refused by name", async () => {
+    const { fetch } = fakeFetch({ "GET /api/v1/repos/acme/infra": {} });
+    await expect(forgejoForge({ ...fjOpts, fetch }).openPullRequest({ head: "h", title: "t", body: "b" })).rejects.toThrow(/no default branch.*pass base/);
+  });
+});